Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I currently have a group of web-services exposing interfaces to a variety of different client types and roles. Authentication is handled through a public/private key pairs (RSA) only to verify the URL as signature in the HTTP Header.

At this time the HTTP Body is not encrypted (I use a private/public key of 2048 bit which allows me to encrypt only small amounts of information), so RSA is not enough safe because the server can no longer prove to himself that there's not a Man-In-The-Middle. I can encrypt also the HTTP body, but what about performance?

My question is: what techniques are recommended to prevent a MITM attack in this case?

share

merged by sysadmin1138 Jun 7 '11 at 2:01

this question was merged with What techniques are recommended to prevent a MITM attack when using a public/private key pairs (RSA)? because it is an exact duplicate of that question.

comments disabled on deleted / locked posts